{"id":"CVE-2020-13405","aliases":["GHSA-pmxg-w9c7-ffmq"],"url":"https://o3.security/vulnerability/CVE-2020-13405","summary":"Microweber Discloses Sensitive Information","details":"userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.","published":"2020-07-16T19:15:12Z","modified":"2026-07-08T06:00:24.454324217Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"microweber/microweber","fixedVersion":"1.1.20"}],"fix":{"url":"https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6","label":"microweber/microweber@269320e"},"references":[{"type":"FIX","url":"https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6"},{"type":"EVIDENCE","url":"https://rhinosecuritylabs.com/research/microweber-database-disclosure/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:00:24.454324217Z"}}